Controlled Folder Access is a Microsoft Defender feature that helps protect valuable files from ransomware and other malicious apps. It prevents untrusted applications from changing files in protected folders. CISA describes the built-in Windows capability as a no-cost control that helps protect folders, files, and memory areas from unauthorized changes. [1] [2]
Choose the management method
For a single Windows 11 device, use Windows Security. For an organization, Microsoft recommends managing Controlled Folder Access through Microsoft Intune or Microsoft Configuration Manager. Intune uses an endpoint security Attack surface reduction policy, while other environments can use the Defender portal, MDM policy, or Group Policy. [3]
1. Start with audit mode
Before blocking applications, test the effect of the policy. Audit mode records activity that would have been blocked without immediately preventing the change. Use the audit period to identify business applications, scripts, backup tools, and line-of-business software that legitimately modifies protected files.
For managed devices, Microsoft documents Audit Mode as a value for the Controlled Folder Access setting. Move to Enabled only after reviewing the results. [3]
2. Enable the feature in Windows Security
- Open Windows Security.
- Select Virus & threat protection.
- Under ransomware protection, select Manage ransomware protection.
- Turn on Controlled folder access.
The exact labels can vary slightly by Windows build and management policy. If the switch is unavailable or controlled by an organization, use the device-management policy rather than overriding it locally.
3. Add folders that need extra protection
Use the protected-folder controls to add data locations that are important to the business or household, such as a finance folder, project archive, or local working directory. In Intune, Microsoft documents adding paths individually or importing them from a CSV. Avoid protecting temporary folders that many applications must write to unless you have tested the workflow.
4. Allow a trusted application
If a legitimate application is blocked, add the application executable to the allowed-applications list only after confirming its publisher, installation path, and business need. Microsoft supports adding or importing application paths and allows environment variables and wildcards in the managed configuration. [3]
Use the narrowest executable path possible. Do not allow an entire broad folder or an unknown executable simply because it is convenient.
5. Monitor and tune the policy
- Review Controlled Folder Access activity and identify blocked applications.
- Confirm whether each block was expected or suspicious.
- Allow only verified applications that require access.
- Restart an allowed application if necessary so it picks up the new permission.
- Keep monitoring after moving from audit mode to block mode.
Microsoft provides monitoring guidance to help find false positives and maintain protection without unnecessarily interrupting work. [4]
Manage the feature centrally
For Microsoft Intune, create an endpoint security policy with Manage > Attack surface reduction, choose Windows, and use the Attack Surface Reduction Rules profile. Configure Controlled Folder Access in the policy settings, assign it to a test device group, review audit results, then expand the assignment. [3]
Important limitations
Controlled Folder Access is one layer of ransomware defense, not a replacement for tested backups, patching, least privilege, email security, and incident response. Keep a separate recovery plan and test restoring important files. If a device experiences a suspected compromise, do not rely on the policy alone; isolate the device and follow your incident-response process.
